rpms/traceroute
7
0
Fork 0
Code Issues Pull Requests Releases Activity

review of CWE-170, CWE-772

Browse Source 
Resolves: #1938887
This commit is contained in:
Jan Macku 2021-07-19 10:12:32 +02:00
parent 31a14c6727
commit 45046983af
2 changed files with 65 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
001-review-of-CWE-170-CWE-772.patch Normal file
View File

@ -0,0 +1,57 @@
From 4bbfd43121e4c1f59074b1b0def9804c1890b2dc Mon Sep 17 00:00:00 2001
From: Jan Macku <jamacku@redhat.com>
Date: Mon, 19 Jul 2021 09:48:19 +0200
Subject: [PATCH] review of CWE-170, CWE-772
Resolves: #1938887
---
libsupp/clif.c | 2 ++
traceroute/traceroute.c | 7 ++++++-
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/libsupp/clif.c b/libsupp/clif.c
index 4ef20e4..60ec291 100644
--- a/libsupp/clif.c
+++ b/libsupp/clif.c
@@ -229,10 +229,12 @@ static void err_bad_arg (const CLIF_option *optn, char c, int n) {
if (c) {
s = show_short (&tmp); /* always without arg... */
+ /* coverity[buffer_size_warning] - not a bug, s ends with '\0', see line 97 */
strncpy (ss, s, sizeof (ss));
s = show_short (optn);
} else {
s = show_long (&tmp); /* always without arg... */
+ /* coverity[buffer_size_warning] - not a bug, s ends with '\0', see line 97 */
strncpy (ss, s, sizeof (ss));
s = show_long (optn);
}
diff --git a/traceroute/traceroute.c b/traceroute/traceroute.c
index 4be9b24..0a29e36 100644
--- a/traceroute/traceroute.c
+++ b/traceroute/traceroute.c
@@ -217,8 +217,12 @@ static int getaddr (const char *name, sockaddr_any *addr) {
}
if (!ai) ai = res; /* anything... */
- if (ai->ai_addrlen > sizeof (*addr))
+ if (ai->ai_addrlen > sizeof (*addr)) {
+ /* Avoid of leaking res (CWE-772) */
+ freeaddrinfo (res);
return -1; /* paranoia */
+ }
+
memcpy (addr, ai->ai_addr, ai->ai_addrlen);
freeaddrinfo (res);
@@ -244,6 +248,7 @@ static void make_fd_used (int fd) {
close (nfd);
}
+ /* coverity[leaked_handle] - not a bug, see line 665 */
return;
}
--
2.31.1

9
traceroute.spec
View File

@ -2,11 +2,13 @@ Summary: Traces the route taken by packets over an IPv4/IPv6 network
Name: traceroute
Epoch: 3
Version: 2.1.0
Release: 14%{?dist}
Release: 15%{?dist}
License: GPLv2+
URL: http://traceroute.sourceforge.net
Source0: https://downloads.sourceforge.net/project/traceroute/traceroute/traceroute-%{version}/traceroute-%{version}.tar.gz
Patch001: 001-review-of-CWE-170-CWE-772.patch
Provides: tcptraceroute = 1.5-1
Obsoletes: tcptraceroute < 1.5-1
@ -29,6 +31,8 @@ problems.
%prep
%setup -q
%patch001 -p1
%build
%make_build CFLAGS="$RPM_OPT_FLAGS" LDFLAGS="$RPM_LD_FLAGS"
@ -51,6 +55,9 @@ ln -s traceroute.8 $RPM_BUILD_ROOT%{_mandir}/man8/tcptraceroute.8
%changelog
* Mon Jul 19 2021 Jan Macku <jamacku@redhat.com> - 3:2.1.0-15
- review of CWE-170 and CWE-772 (#1938887)
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 3:2.1.0-14
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937